buffer: throw when writing beyond buffer

Previously one could write anywhere in a buffer pool if they accidently
got their offset wrong. Mainly because the cc level checks only test
against the parent slow buffer and not against the js object properties.
So now we check to make sure values won't go beyond bounds without
letting the dev know.

1 files changed, 3 insertions, 0 deletions

diff --git a/lib/buffer.js b/lib/buffer.js
index c75dbc93a8..000c54b3a8 100644
--- a/lib/buffer.js
+++ b/lib/buffer.js
@@ -339,6 +339,9 @@ Buffer.prototype.write = function(string, offset, length, encoding) {
   }
   encoding = String(encoding || 'utf8').toLowerCase();
 
+  if (string.length > 0 && (length < 0 || offset < 0))
+    throw new RangeError('attempt to write beyond buffer bounds');
+
   var ret;
   switch (encoding) {
     case 'hex':